650fb063b6d596e6a34aaf31499f4b6d741b2ed6dd59dafce75714a47f3fc937

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d9a36d1c6469676ab175faf6cff041f_JaffaCakes118.html
Size

4KB
MD5

7d9a36d1c6469676ab175faf6cff041f
SHA1

7a651168f8656ed8ad37929992c412fb5ad4892d
SHA256

650fb063b6d596e6a34aaf31499f4b6d741b2ed6dd59dafce75714a47f3fc937
SHA512

4fb9742b4a58719c1cc05712509fe6b338fd8769d8b3343200428f174deaec55809e0a8988bb41baa355aead9120c08264a1f56c4e82204dc629758a5bc20c99
SSDEEP

96:4UYt2P2nJxe37ED5fEKcbNcrOaWxmkc+4sXn6Exd3tKf0Wga/jrR:benveLEDVTcWrOmPg62dtcpN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000003d899c26ba12b4aa78f7ae25883d11b00000000020000000000106600000001000020000000fa1dbb3885815782fe9bc0b455d1e89e8de98c5e8514c7af5505e7506ec5be4c000000000e80000000020000200000001185c6714334604955c316122199e5b94ffee9db78e24f67e8627d8af0bb6f7b20000000744622ee45c93433196fa1ebdff73f85f9adb0e7c2f47ea9bf2d8ebe924e469640000000a738054663e9ad9efc5d7b8af1ffdb367bb80da7ee8c75d68d8b492e3bfb4e6e713581c86958e8c53316f70d01b93971d2614c42ee2e1464c1a24dbcec74242e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01a6d101bb1da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000003d899c26ba12b4aa78f7ae25883d11b000000000200000000001066000000010000200000007890034c5082fb029f08ad3bd11f09797ba49945f5694f2801c68f89327a9fcc000000000e8000000002000020000000eaae3f7a44815b1ec47061ef86298f6b01f7b9030710b37fdcf337a3fe41044a9000000042da9629e19d23b713eb552340e87f076facdd3a392d37f2595a7b35009f25fadc18fb357d61cfb0462722f650a084fc33817df5a3c8c471a6388bdcd688217e97f2d6c28d5247586ea864aaa14e30f6f83b4aecb5648b04dbc0ca5983a67d05a028d97e09d0753763dbdf5788f0f28f555d1bd41567a71990b4bbd683bbfc90116c8a674e04f310cac2aa27703cff1d40000000dffa513cb50ff5a6384688ee1eb5c931883e5319a323514ef9b32902152541e47a856040e9b4a4670e63efa285a0ed476455b117e0e1b5ab06701ef61ffe064e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423075111"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BD817E1-1D0E-11EF-B238-4AE872E97954} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1896	iexplore.exe
1896	iexplore.exe
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2872	1896	iexplore.exe	28
PID 1896 wrote to memory of 2872	1896	iexplore.exe	28
PID 1896 wrote to memory of 2872	1896	iexplore.exe	28
PID 1896 wrote to memory of 2872	1896	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7d9a36d1c6469676ab175faf6cff041f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1896 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
967b555b18e15ca08a4e0d086780dfe7

SHA1
0a0a9d532ab4fcd47c231f6bb07f5d2f77851841

SHA256
5bc6a770bb04568f3fb7dbfd2024d03c5bceafe141385378f2d7281b34744aad

SHA512
8d540916043832c19be0139c11d4ba1eab02b68b9f2d0c1d145e221e5f40b1a8e4d496f87a4021d38f114fba17a110e1a1d884f9b39211273c51d95cf528012e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
777538fd2874063baf965d59516d640e

SHA1
491ad9dfbd020368be022dce93adccb64183876e

SHA256
a107728c408ffba91b73701115f27fa735225f38c0f43319ca0fa9ccb5916ea9

SHA512
11ded7d1cfa8a9eeb89ae3fb97daf283d56761d6f266b4c059ac4224c3e3da75f579e0896847309a3b7127de297c2ebe697327ff764fd4bfd7764542b84e028a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bef7a193eee0195ea8a03c014795fe47

SHA1
7f300557e78742188b182e6fe465bab58d38729a

SHA256
530c85c15804291826d435d89dc67b5d11c981efb486dc0462dbce214fd149ad

SHA512
0731cb70dcc93951d81e7eb6e53eae74e0bf5097ed03530dfbb072068289972098eac1e64585ddaf175bd75055f920219317daf869aa0d7841276b830eed40f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bc73eda6e5e88d49dc38191375c92bb

SHA1
a7173dbb8aa3fe537e162acfc1cea5837dcf0521

SHA256
e032006fe51f3f885cf92883f71dd023b564dff0228041d8b7ce2b780bb7ecb9

SHA512
5ce4b8e564b4edfdc40a942da8a6a991ed7259c9c0018fa2f26fcdff25c670431d94750136a5767c847cd4e48092f0f9dc1edfb71018377a470ced74619ed028

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
684b4f42e965a52332cd8fee32885472

SHA1
e953ac2be9dec8c59989b88cc777216b2c4c3757

SHA256
45033e37b8b54becd083db764cabbb4511587d2af223594e90901116d03e3b37

SHA512
7d4c9ad06319dc239d709194d839c0124739160f5fe27e881e71762ef69e9f05f1fd3702b55e5b778f8ed861d18e98351fec12736cbf4886ab9ee2fd3368fc21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64032cf5b1293c5bb58e49978b6e44c0

SHA1
a2e6949470f3b2f04d3131c0d5b151e606376bea

SHA256
5aa13d8e287cecbdec791323ae2c7bead8c70564d4406683008c866680c103fe

SHA512
520c7a1f73ec2d58526f1a59e0f00fd5af0be3bed63d07c743d232226e7e6d926cada793ceb53d9e767f6b5b52c679f54ab33335dea5c2da6cb0d24e74393387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cff59faac968bfac84d23b15fddd7f1f

SHA1
120fd63bd390e4b0af22ac056bd4738b224a281e

SHA256
0894c9499faf0a5a8870a5a426fffca7bb91ea1b4bf845146cc479285a776d7d

SHA512
4e2c76f947b951d4d4a34f043ea57051a03f31946b5b37513be193d61d2a21a58676f65cfa5b339c6c80bab348773394316b55629bfe36b4f43504fb6a755d27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af5a3fb25f0fa5394b5f2fa1ff1c3415

SHA1
b94fef9072ff8937405309a6a234ce149ae50792

SHA256
e9c3940756bc40a930aae5316f100af858679e75374b499928f3fd8384bcc80b

SHA512
92b48dc8496220d9ab92a6773c893238af3c5e14453c53a3d1dabe75f7f5a010c0dd1ff143b92797b2c4df7031b163c2f73ea1b5e076e0e98f05e4fa8d4d527d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bef1db12dd1cbd0c50719ea92fc87d9c

SHA1
5fe6d56625059a282deb3236d2117cda63d3b2e1

SHA256
d568fbf4a85be66e10ecd51f7c2e53ec54b4e1047509393aed978add4f25b4e9

SHA512
2e1d57e36bafaa9b93a8e14d5225c765e511bfa6d93e7dd858320a24cf36d5cf217f6f8112fcf15eeb4332a6078856d60750bf7aaeaeda5f6becc86ca49ccbb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e13c20731be782b2a1b3a1d765587a08

SHA1
69d4d5791ea0a702b73bd29e195db5df54fc1aa2

SHA256
138c1a0d51cf7b3aa252e3f9456a4614dfbcbab320f158fb450b017a87d56f83

SHA512
6afa07cd3656c0123789ee6836f6459746fd11855dacfd93e733d601cf8f055f61185a293ab51a0c35d49965a36a67962cf3bc25c8cf8cb69b889cc8e0fe1aca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ae5bf6cb29c436ee2308cc760599e7d

SHA1
8eeb6fb0ab1435623fb2445c4ef2f22d86dce500

SHA256
ac8030fd4c5db0ed572c782e43f779f8b34a252bb381ac0a4573a0ebb3ebe543

SHA512
2c44b34f8fedd814705c29a0bb44591a707c94b32e9fdd9dd3339033077dc7490a05ddf24aaf416aa1c05f6cca82b73cfcb40610613005a56d45c470e83ec3e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db2665fb867690d26f9aafb8daedc8c0

SHA1
bc78efa7721c1e6be4446f3d2bd47c32686b3f5b

SHA256
ec6f9c58876f5d9a0cfe1769956bfef97da0603d3fd8c68fdb528b68dd24d3cf

SHA512
4a6af0cade26115d1b541ea797961a3e6aa5f585d2f8d96fe3a030d141a908dc118e01101ee0b31195c1ab6dd821f86629c87beeed92205f5e04608e2bdb1478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df6ab62472cab71ed5665a84a4c0da4c

SHA1
e02b0121136b472869f91725a04e9b51a092cd49

SHA256
7b07630e03683464b7469dc337b781a425a92a90341e7a0caa01c1587190aa06

SHA512
4f77c28d464a2e19595d7d2776a61fe8f1fc047d2064eb624d840da8ab461345889e053db2d2333d6fc83ab9777c0b8d3a61af5142f3d5b28f7eefd78ba13732

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
749ad2e8b968a2374ccfda4555a6315e

SHA1
b70aa74a65cbec2e58fb7afd70c3af0c784f5714

SHA256
8315f2fb8e62da37c41f8ba23c710a2a62a4eac612d075ec7631306946c713d6

SHA512
1033d2ae17772019f750dfc577e3ccb2088da28b75d5db6154cb303748703da415efb6fd5fa83d147e385edb9d338069a2b98d219bd70c2ff089075d4bab0455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
360ffab94abb1df0348c71fa17c9b507

SHA1
e184a47f8c85e8fc0d8d6af733f8351360c76394

SHA256
da63e8a4346368d2510a5332e39bd186d8649a8c095e79b580bbab7a2ab4b146

SHA512
04c69cb7e7c3942389244d785c41c420abca41011c2833038d1fba87ce4e2f8d2a927a52eed2fcd601148975949c0f606ab5d522bac7bd1e66133a13fd44e119

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e961e69c652820962a40d45e4b187a27

SHA1
dad1f0cf4d496db5807df2846ac320107a6dc670

SHA256
450360f4ee2fbabadc8d2537780a895864a21559330f7a0578f0769558ae4754

SHA512
deb054bf77186ac8b31de7865b143d4e87a9d4857dc5e0f1ea1196accf8a53aeafeea444e66dbd529913a041d14eeaae0604fb5c5956caa6213aac037eabad60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab38AF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3ABA.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit